Source code vulnerability detection and repair through machine learning

Abstract

A neural classifier model is used to detect cybersecurity vulnerabilities in the source code predicted by a deep learning code generation model having been trained on source code possibly containing security bugs. Upon the classifier model classifying a given source code snippet as likely containing a cybersecurity vulnerability, a proposed repair for the cybersecurity vulnerability is predicted from a neural decoder transformer model having been trained on non-vulnerable source code. The neural decoder transformer model is used to predict source code that repairs the cybersecurity vulnerability given the source code classified with a cybersecurity vulnerability.

What is claimed: 
     
         1 . A system comprising:
 a processor; and   a memory that stores a program configured to be executed by the processor, wherein the program comprises instructions that perform acts to:   obtain a source code snippet;   identify through a neural classifier that the source code snippet comprises a cybersecurity vulnerability; and   generate repair source code that repairs the cybersecurity vulnerability in the source code snippet, wherein the repair source code is generated by a beam search component coupled to a decoder neural model, wherein the beam search component generates partial repair code sequences of tokens iteratively at each of a plurality of timesteps, wherein the beam search invokes the neural decoder model, given the source code snippet and the cybersecurity vulnerability, to generate at each time step a probability distribution to identify select tokens to be the next token in a partial repair code sequence, wherein the beam search expands each partial repair code sequence from the select tokens identified by the probability distribution output, wherein the beam search ends when a termination token appears as the most probable next token for a select partial repair code sequence which is then output as a sequence of tokens representing the repair source code.   
     
     
         2 . The system of  claim 1 , wherein the source code snippet comprising the cybersecurity vulnerability is generated by a machine learning model. 
     
     
         3 . The system of  claim 1 , wherein the program comprises instructions that perform acts to:
 extract the source code snippet comprising the cybersecurity vulnerability from a pull request, wherein the source code snippet comprising the cybersecurity vulnerability includes changes to a code base.   
     
     
         4 . The system of  claim 1 , wherein the cybersecurity vulnerability comprises a Common Vulnerability and Exposures (CVE) vulnerability. 
     
     
         5 . The system of  claim 1 , wherein the cybersecurity vulnerability comprises a Common Weakness Enumeration (CWE) weakness. 
     
     
         6 . The system of  claim 1 , wherein the neural classifier is trained on a plurality of source code with select ones of a plurality of cybersecurity vulnerabilities and a plurality of source code without a cybersecurity vulnerability. 
     
     
         7 . A hardware storage device having stored thereon computer executable instructions that are structured to be executable by a processor of a computing device to thereby cause the computing device to perform actions that:
 obtain a machine-generated source code snippet from a source code edit session;   identify through a neural classifier that the machine-generated source code snippet comprises a cybersecurity vulnerability; and   generate repair source code that repairs the cybersecurity vulnerability in the machine-generated source code snippet, wherein the repair source code is generated by a beam search component interacting with a decoder neural model, wherein the beam search component generates partial repair code sequences of tokens iteratively at each of a plurality of timesteps, wherein the beam search invokes the neural decoder model, given the machine-generated source code snippet and the cybersecurity vulnerability, to generate at each time step a probability distribution to identify select tokens to be the next token in a partial repair code sequence, wherein the beam search expands each partial repair code sequence from the select tokens identified by the probability distribution output, wherein the beam search ends when a termination token appears as the most probable next token for a select partial repair code sequence which is then output as a sequence of tokens representing the repair source code that repairs the cybersecurity vulnerability in the machine-generated source code snippet.   
     
     
         8 . The hardware storage device of  claim 7  having stored thereon computer executable instructions that are structured to be executable by a processor of a computing device to thereby cause the computing device to perform actions that:
 output the repair source code in the source code edit session. 
 
     
     
         9 . The hardware storage device of  claim 7 , wherein the cybersecurity vulnerability comprises a Common Vulnerability and Exposures (CVE) vulnerability. 
     
     
         10 . The hardware storage device of  claim 7 , wherein the cybersecurity vulnerability comprises a Common Weakness Enumeration (CWE) weakness. 
     
     
         11 . The hardware storage device of  claim 7 , wherein the neural classifier is trained on a plurality of source code with select ones of a plurality of cybersecurity vulnerabilities and a plurality of source code without a cybersecurity vulnerability. 
     
     
         12 . A computer-implemented method, comprising:
 obtaining a pull request from a source code repository, wherein the pull request comprises a modified source code snippet;   identifying, through a neural classifier model, that the modified source code snippet includes a cybersecurity vulnerability; and   generating repair source code that repairs the modified source code snippet, wherein the repair source code is generated by a repair engine comprising a beam search component and a decoder neural model, wherein the beam search component generates partial repair code sequences of tokens iteratively at each of a plurality of timesteps, wherein the beam search invokes the neural decoder model, given the modified source code snippet and the cybersecurity vulnerability, to generate at each time step a probability distribution to identify select tokens to be the next token in a partial repair code sequence, wherein the beam search expands each partial repair code sequence from the select tokens identified by the probability distribution output, wherein the beam search ends when a termination token appears as the most probable next token for a select partial repair code sequence which is then output as a sequence of tokens representing the repair source code that repairs the cybersecurity vulnerability in the modified source code snippet.   
     
     
         13 . The computer-implemented method of  claim 12 , further comprising:
 providing the repair source code to the source code repository.   
     
     
         14 . The computer-implemented method of  claim 12 , wherein the cybersecurity vulnerability comprises a Common Weakness Enumeration (CWE) weakness. 
     
     
         15 . The computer-implemented method of  claim 12 , wherein the cybersecurity vulnerability comprises a Common Vulnerability and Exposures (CVE) vulnerability.